Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

macOS High Sierra: Anyone can login as “root” with empty password

twitter.com

Post reply on HN
Print view View original

611–620 of 1001 posts

Re: macOS High Sierra: Anyone can login as “root” with empty password

#611

Post by saas_co_de »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

> Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool

no one is under any obligation to sweep company's security problems under the rug for them.

If companies create incentives for people to share vulnerabilities with them first, great, but no one is under any obligation to participate in those programs.

Don't ship broken software if you don't want pie in your face.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#612

Post by mostlyskeptical »

eridius wrote: post #451
2trill2spill wrote: post #126

Apple has a serious software quality problem. Last night I was helping a friend with their computer. Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Installed FireFox and HTTPS sites worked and apples's site renders. But the submit button on their developer site is broken[1]. Mail on my Mom's fully updated laptop crashes every time it's opened. Once I reported a…

> Safari couldn't even render apples website correctly. Nor could Safari connect to any site with HTTPS. Sounds like something's wrong with your friend's computer, because neither of those issues are reasonable to expect no matter what your opinion of Apple's software is. > But the submit button on their developer site is broken Given the number of people who've successfully gone through that form, I'm willing to bet…

>neither of those issues are reasonable to expect no matter what your opinion of Apple's software is.

Neither is your password showing up in a password hint field (or anywhere for that matter... why is it even stored unhashed?).

Neither is logging in with a blank password enabling a disabled root user.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#613

Post by oneeyedpigeon »

komali2 wrote: post #502
bangonkeyboard wrote: post #303

Earlier quoted context omitted.

macOS and iOS updates at Apple are now inextricably tied to new iPhone releases. There is a strict yearly deadline that the teams sprint toward, a timeline imposed by marketing rather than readiness. This affects prioritization of which features are pursued, where they lie in the stack, and how polished they get. Insufficient testing at today's Apple is not limited to software. They bragged about their extensive inpu…

Haven't deadlines at Apple always been driven by marketing? I'm looking for a source but I remember a story where the product director for iPod was told by steve jobs "make it simple, fast, beautiful, and have it done by Christmas."

That's sure to send shivers down the spine of anyone reading it here but, to be fair to jobs, he managed to get exactly what he wanted on that occasion.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#614

Post by RJIb8RBYxzAMX9u »

abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

osquery is not a built-in tool. You can get the same info with plutil(1):

  $ sudo plutil -p /private/var/db/dslocal/nodes/Default/users/root.plist
If I understand OP correctly, if passwd is a lone asterisk, then you haven't been exploited.

Edit: trying a little harder to dump accountPolicyData:

  $ sudo defaults read /private/var/db/dslocal/nodes/Default/users/root.plist accountPolicyData | grep -oE '[[:xdigit:]]+' | xxd -r -p

Re: macOS High Sierra: Anyone can login as “root” with empty password

#615

Post by mbesto »

jeffisabelle wrote: post #154

I still can't believe more people complain about this being publicly disclosed than this being possible in the first place. No one is obligated to know the procedures on InfoSec 0-days and follow those steps.

Except when people politely explain to the original poster not to do what he did. His tweet and a follow-up tweet still exist on the topic. He could easily delete them.

If you read through the comments, you'll see people are arguing that Apple is to blame here. It doesn't require much discourse to recognize that's the case and hence why you don't see more people complaining about this being possible in the first place.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#616

Post by abritishguy »

RJIb8RBYxzAMX9u wrote: post #614
abritishguy wrote: post #534

Just in case it is relevant for anyone here this is what our security team have established thus far: - Can be mitigated by enabling the root user with a strong password - Can be detected with `osquery` using `SELECT * FROM plist WHERE path = "/private/var/db/dslocal/nodes/Default/users/root.plist" AND key = "passwd" AND length(value) > 1;";` - You can see what time the root account was enabled using `SELECT * FROM p…

osquery is not a built-in tool. You can get the same info with plutil(1): $ sudo plutil -p /private/var/db/dslocal/nodes/Default/users/root.plist If I understand OP correctly, if passwd is a lone asterisk, then you haven't been exploited. Edit: trying a little harder to dump accountPolicyData: $ sudo defaults read /private/var/db/dslocal/nodes/Default/users/root.plist accountPolicyData | grep -oE '[[:xdigit:]]+' | xx…

That's correct.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#617

Post by saagarjha »

thomastjeffery wrote: post #587
saagarjha wrote: post #513

Earlier quoted context omitted.

A better analogy is that there's a fire somewhere in your village, but it's mostly contained (it's not spreading, because other people don't know about it yet). By hollering about it, you've made it possible for anyone to go to the fire, light a torch with it, and burn down the village. Instead, you could call up the fire department and they could put it out–and then you could tell everyone about it.

> you've made it possible for anyone to go to the fire, light a torch with it And at the same time provided everyone with a simple, free, and perfect way to fireproof his/her house. You could wait for the fire department, which may take hours to get there, and hope that no malicious party down the street saw the fire, or you can do this. It turns out that both are quite reasonable reactions in this scenario, and that…

> And at the same time provided everyone with a simple, free, and perfect way to fireproof his/her house.

The issue here is that it isn't perfect in the long run (having a root account with a password is worse than not having one) and many people will not be adopting it since they're not in the know.

Of course, it is always possible people have been already exploiting this, but most likely it is at most a small number of people who know about it. Now every script kiddie in the world can and will go around trying to hack anyone who isn't well-informed enough to know how to protect themselves.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#618

Post by romwell »

patcheudor wrote: post #32

Apple makes it pretty easy to report vulnerabilities to: product-security@apple.com They also respond to security@apple.com but prefer the product-security address. Further, there are any number of legit bug bounty programs out there like ZDI that would pay for a bug like this then immediately disclose to Apple for it to be fixed. Disclosing an 0Day root authentication bypass vulnerability on Twitter isn't cool, even…

Because clearly, the random Apple user that stumbled upon it should both be aware of and follow the protocols of security researchers.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#619

Post by jlgaddis »

joshuaturner wrote: post #471
camus2 wrote: post #423

Earlier quoted context omitted.

And Full disclosure is about protecting users of a software, not letting the vendor off the hook. Here, the hack and the fix are so trivial the responsible thing to do is to publicly call out Apple for its lack of QA and warn users directly. It affects everybody who runs High Sierra. > it puts millions of Apple customers at risk in the process. Nah, it's Apple which put millions of customers at risk, not the person w…

I would argue that releasing this vulnerability as irresponsibly as he did is showing he cares more about negative publicity than user security. Yes, it's Apple's fault for poor QA that this was released, but this guy also put users at risk by telling the entire world about it without giving Apple a chance to fix it. You're right, it's about user security before publicity. So make sure users are safe first.

"as irresponsibly as he did" is how all vulnerabilities were announced, at one time. I miss those days, personally.

Nowadays, you're "irresponsible" if you don't follow some vendor's own made up procedures.

Re: macOS High Sierra: Anyone can login as “root” with empty password

#620

Post by copperx »

r3bl wrote: post #570
joe_the_user wrote: post #546

Earlier quoted context omitted.

A bug like 'can log in with password "root"/""' just isn't going to get you a grace period no matter what security researchers might want. I mean, this bugs has been reported already - by every cheesy hacking movie ever, by every beginners book on social engineering and so-forth. Heck, it was "reported" by Richard Feynman talking about cracking safes during the Manhattan.

Grub's "backspace 28 times to a rescue shell" was also a stupid one, but it first got fixed, and then made it to the news.

This reminds me of jwz's XScreenSaver rant.

https://www.jwz.org/xscreensaver/toolkits.html

Post reply on HN